Preamble and purpose
This policy explains how Viatous uses and protects your data on its website and applications. It covers visitors, account holders, participants, winners and contacts at partner brands.
We collect information needed for the service, security and our obligations. We do not sell your data. Optional advertising relies on your consent. This policy supplements our terms of service and our cookies and credits policies.
Data controller
The data controller is Viatous SAS, 47 rue Vivienne, 75002 Paris, France.
For questions about your data or to exercise your rights, contact our team at [email protected]. This is our contact address for personal data protection.
Data we collect
The data processed depends on the features used:
- Account and profile: first and last name, email, phone when provided, photo, language, time zone, preferences, signup source and referrals; protected password, Google identifier and session information depending on the login method.
- Free and paid entries: account identifier, competition, entry type, amount where applicable, challenge and result. A free entry uses profile data and does not request a separate identity again.
- Challenges: competition, question presented, language, answer, attempts, abandonments, timeouts, timestamps and total time. For games, bubble progress and validation, board configuration and submitted tracing path.
- Prizes and handover: recipient identity and contact details, address, appointment, shipment tracking, codes and handover confirmation; public display choice where offered.
- Partner gems and benefits: originating paid entry, available or used status, creation and use dates, selected offer and brand, gem cost, assigned private code, expiry, redemption link and technical request identifier.
- Verified identity: outcome and data described in the Didit section.
- Payments: Stripe references, amounts, transactions, refunds, withdrawals, referral rewards and payout account information.
- Brands and support: professional contact details, supplied content and images, communications, request category, context reference, submitted messages and attachments. The category may include partner gems and benefits.
- Security: IP address, browser and device characteristics, abuse-prevention fingerprints, access dates, technical logs and push notification identifiers.
- Optional advertising: with your consent, permitted public pages, competition views, registrations and payment events, amounts, event, click or browser identifiers, IP and user agent. Contact details or identifiers may be shared in hashed form to match advertising events.
A hashed identifier is not necessarily anonymous. Required fields are indicated in forms; leaving them blank may prevent the requested operation.
Purposes and legal bases
Our processing relies on the following bases:
- Providing the service: accounts, entries, challenges, ranking by total time, prizes, wallet, withdrawals, referrals, allocation and use of gems, access to the benefits catalogue, delivery of codes and communications needed for handover. Professional contacts enable brand relationships. Content preparation may include translation and image analysis.
- Legitimate interests: securing access, preventing fraud, duplicate registrations, automated entries and duplicate benefit claims, handling incidents and protecting competition fairness. Identity verification supports these checks; a legal obligation may also apply depending on the processing concerned.
- Legal obligations: retaining required accounting records, responding to authorised authorities and handling data rights requests.
- Consent: marketing communications you subscribed to, optional advertising measurement and personalisation, and public display of winner information where that choice is offered.
You may withdraw consent for future processing without affecting processing already lawfully carried out. Refusing advertising does not prevent participation. Communications necessary for accounts, payments, benefits or prizes remain separate from marketing.
Subcontractors and recipients
Authorised team members access information needed for their duties. Details needed for prize handover are shared with the brand and, where necessary, delivery providers. Unlocking a digital partner code does not, by itself, disclose your identity or contact details to the brand. If a benefit requires delivery or other personal information, the necessary data and its recipient are shown to you before it is shared.
We use in particular:
- Google Cloud Platform: hosting and data services.
- Amazon Web Services: file storage and email.
- Stripe: payments and withdrawals.
- Didit: identity verification.
- Cloudflare: website and API protection, abuse prevention and Turnstile.
- Twilio and Firebase Cloud Messaging: SMS and push notifications.
- Google Identity and Gemini: Google login, content preparation, translation and analysis.
- Umami: audience measurement without cookies.
- Google Ads, Meta and TikTok: advertising and measurement with your consent.
Depending on the service, these organisations act as processors or controllers for certain processing activities. Competent authorities may receive data required by a lawful request. We do not sell or rent your data.
Transfers outside the European Union
Some services involve processing outside the European Economic Area, including in the United Kingdom, United States or other countries depending on the provider. Where necessary, transfers are covered by applicable safeguards: an adequacy decision, standard contractual clauses or another recognised mechanism. Not all provider processing necessarily occurs in the country where our application is hosted.
For details about recipients and safeguards applicable to your data, write to [email protected].
Hosting and security measures
Application hosting: Google Cloud Platform, europe-west2 region, in London, United Kingdom.
Media files: profile pictures and competition images are stored on Amazon S3, eu-west-3 region, in Paris, France.
Planned migration: a progressive migration of our application services to a European Union region, in Paris or Belgium, is planned for the future. We will update this policy and give advance notice where required by law or justified by the impact of the change.
Security: encrypted communications, protected passwords and sessions, encryption of stored data, administrative access controls and request limits to prevent abuse. Private partner-benefit codes are encrypted in our database. These protections are adapted to the website and mobile applications.
Backups: daily database backups retained for seven days in Google Cloud’s European Union multi-regional zone. Point-in-time recovery is enabled for the last seven days.
Access is restricted to authorised people according to their duties. In the event of a data breach, notifications to the competent authority and affected people are made under applicable legal conditions, including notification to the authority within 72 hours where required.
Retention periods
Retention depends on the data and its use:
- Active account: during your relationship with Viatous, subject to the deletion and inactivity procedures below.
- Requested deletion: cleanup from 30 days after the request, with a reminder scheduled for day 23.
- Inactivity: procedure starting after five years without logging in, with at least seven days after a reminder is successfully sent, subject to the conditions below.
- Accounting records: ten years for documents subject to that obligation.
- Local application logs: rotation configured for 30 days. Provider logs follow their own settings and obligations.
- Database backups: seven days, with point-in-time recovery over the same period.
- Structured identity data at Viatous: cleaned up with the account under its deletion lifecycle.
- Didit verifications: retention configured to ten years in our Didit service. This is our setting, not a universal statutory period.
- Partner gems and codes: an available gem is kept with the account until it is used or the account is cleaned up. An assigned code and its history remain available during the active relationship and for as long as needed to enable use of the code, manage the offer, handle a claim, prevent fraud or prove the allocation.
Entries and results: results, times and records needed to administer competitions, handle claims and meet legal obligations may be retained after account cleanup. Free entries are linked to the account. Results and records still needed may be retained after account cleanup for these purposes and ongoing operations.
When the account is cleaned up, identifying data is deleted or replaced. Technical records still needed for an entry, a used gem or an assigned code may remain linked to an anonymised technical identifier with restricted access. Backups follow their own rotation; deletion from the active service does not mean immediate erasure from every backup or provider record.
Your GDPR rights
Under the conditions of the GDPR, you may request access, rectification, erasure, restriction of processing or portability of the data concerned. You may object to processing based on legitimate interests for reasons relating to your situation; you may object to direct marketing at any time.
You may withdraw consent and provide instructions concerning your data after your death. Where a solely automated decision has legal or similarly significant effects and the conditions of Article 22 apply, you may request human intervention, express your views and contest the decision. Identity and security checks and contest ranking may involve automated processing; our team can review a dispute.
These rights are subject to applicable legal conditions and exceptions, including the retention of certain supporting records.
How to exercise your rights
With an account: your profile lets you edit the available information, manage preferences and request deletion. Under “Security & Privacy”, “Download my data” provides an Excel file including your profile, entries, challenge results and attempts, prizes, financial transactions, and a sheet covering your partner gems and assigned codes. This export does not include every internal security element or data held only by our providers. Contact us for an additional request.
Connected free entry: it appears in your personal area alongside your other entries. You can exercise your rights from your profile or contact Viatous for an additional request.
Other requests, including those from brand contacts, may use the same email. Additional identity evidence is requested only where there is reasonable doubt. Please do not send an identity document unsolicited.
Response time: we normally respond within one month. This may be extended by two months depending on the complexity or number of requests; we inform you within the first month and explain the extension.
Account deletion on your request
You can request deletion from your profile. For an email-created account, your password confirms the request. A blocked account must contact support. A profile request is also prevented while there is an ongoing prize, an entry is still valid, final redistribution or gem allocation is still pending, a withdrawal is being processed, a positive wallet balance remains or a partner gem is available. This does not remove your right to send us a request concerning your data.
Automatic cleanup takes place from 30 days after your request. A reminder is scheduled for day 23. You can cancel the request from your profile until final cleanup has occurred.
Account contact details and the personal information concerned are deleted or replaced, including identity data held by Viatous, handover details for prizes linked to the account, favourites, notifications and personal support content. Relevant personal files are cleaned up when no longer used elsewhere. Necessary results, accounting entries and technical records remain retained with restricted access.
Deleting an account does not delete brand competitions. Free and paid entries linked to the account follow the same cleanup, subject to results and records that must be retained. A gem already used and a code already assigned do not, on their own, block deletion; necessary records may remain linked to the anonymised technical identifier.
Removing profile data does not mean all retained information becomes irreversibly anonymous. Information still needed must remain protected with restricted access. Closure of relevant Stripe profiles is requested during cleanup; providers’ own obligations may require retention of some information.
Prolonged inactivity
After five years without logging in, eligible accounts receive a reminder inviting them to log in again. Cleanup may occur at least seven days after that reminder is successfully sent, without a new login.
This procedure does not apply while there is an ongoing prize, an entry is still valid, final redistribution or gem allocation is still pending, a withdrawal is being processed, a positive wallet balance remains, including non-withdrawable credits, or a partner gem is available. These conditions are checked again before cleanup.
Logging in resets inactivity monitoring. Cleanup follows the scope described for account deletion, distinguishing removed data from information still needed for operations and legal obligations.
Identity verification (Didit)
For users with an account, Didit performs identity checks offered through the profile. Depending on the configured check, Didit collects an identity document, a verification photo or capture and information needed for liveness and duplicate detection.
Viatous stores the outcome, verification reference, dates and, when supplied, rejection reason, official names, date of birth, gender, document number and issuing country. This helps verify adulthood and detect some identities already used. Viatous does not store identity-document scans or biometric captures in its profile database.
Verification retention is configured to ten years at Didit. Processing and data rights are described in the Didit verification notice. Our team can assist with a verification request.
The winner follows the same verification journey from their account whether the winning entry was free or paid.
Payments and withdrawals
Stripe processes card payments for entries and deposits, and payouts needed for wallet withdrawals. Card details are entered in Stripe’s secure components; Viatous does not store the full number or security code.
Withdrawal account: when creating or changing a Stripe Connect account, your IBAN passes through our service to be sent to Stripe. Our payout account record stores the Stripe identifier, country, last four characters of the IBAN and activation status, not the full IBAN.
Stripe may request additional information or documents for its checks. Viatous retains references and transactions needed to track payments, withdrawals, refunds and accounting obligations.
Brand products: when a product is purchased from a partner brand under the professional agreement made with it, Viatous stores the purchase amount, bank-transfer reference, transfer and confirmation dates, and the identifier of the administrator who recorded the operation. When the product is provided by the brand, no purchase transfer is recorded. This tracking is separate from participant payments and credit redistribution.
Partner gems and benefits
After confirmed handover of the product, each eligible non-winning paid entry may receive one partner gem. Viatous records the beneficiary account, originating entry and competition, available or used status, and creation and use dates.
When you unlock an exclusive benefit, we process the selected offer and brand, number of gems used, assigned code, expiry date, redemption link and a unique technical identifier that prevents a duplicate claim. Private codes are encrypted in our database and revealed only to the account to which they were assigned.
Public promo codes are available for zero gems and are not private allocations. Unlocking a digital code does not, by itself, disclose your identity or contact details to the brand. If fulfilment of a benefit requires delivery or other information, the necessary data and its recipient are shown to you before it is shared.
Cookies and other trackers
The service uses mechanisms necessary for login, preferences and security. Stripe and Cloudflare protections, including Turnstile, may process technical information to prevent abuse. Turnstile analyses IP addresses and browser characteristics among other information; it is not an advertising feature. See the Turnstile notice.
Umami measures audience without cookies. On the web, Google Ads, Meta and TikTok are enabled only in permitted contexts and with your consent. Advertising events associated with registrations and payments also require consent. Private and legal pages are not among public pages permitted for these advertising views.
You can manage or withdraw consent through cookie choices. Our cookies policy details trackers and how to control them.
Protection of minors
Participation is restricted to people aged 18 or over. Identity verification checks this condition. It can also be started through the profile before winning.
When a check confirms that a person is underage, verification is declined and the account is blocked. Our team reviews possible errors and consequences for ongoing operations under the rules. Data is handled according to applicable rights and any information still necessary to retain.
To report underage use or request a review, contact [email protected].
Updates to this policy
This privacy policy may be amended to reflect a legal, technical or editorial change.
The version applicable at any given time is the one published at the date of your visit. The “Last updated” notice at the top of the page identifies the version in force.
Information about a material change. Where a change has a significant impact on your rights or on how your data is used, Viatous provides appropriate advance information where required by law or justified by the impact of the change. This information may be displayed on the platform or sent by email, depending on the context.
Contact and complaints
To exercise your rights or ask about your data, write to [email protected]. Our team handles requests from account holders, visitors and brand contacts.
You may also lodge a complaint with the CNIL, 3 place de Fontenoy, 75007 Paris, France, if you believe your rights are not respected.